Key Takeaways
- Austrian advocacy group NOYB alleges that Bumble For Friends obtains user data without the user’s consent in breach of the GDPR.
- Bumble For Friends claims it has a “legitimate interest” in user data for protective and marketing purposes.
- The GDPR admits its vague stance on user privacy, and Bumble For Friends defends its “legitimate interest,” even though NOYB calls this claim “absurd.”
In the wake of Bumble’s 30% workforce reduction comes another tough blow to the company: an Austrian privacy complaint centered on Bumble For Friends.
The complaint, which was filed by digital rights advocacy group None Of Your Business (NOYB), alleges that the friendship app’s AI Icebreaker feature takes data from the user’s profile regardless of whether the user has given their consent.
If the allegation is proven true, Bumble would be in violation of the EU’s General Data Protection Regulation (GDPR), which, according to the law’s own website, is “the toughest privacy and security law in the world.”
As AI continues its digital takeover, including on dating apps, the GDPR attempts to set an industrywide standard in the EU for data privacy and protection. But even the GDPR site acknowledges that the law is “large, far-reaching, and fairly light on specifics.”
Still, a company that disregards the GDPR can potentially suffer a financial toll of up to tens of millions of euros in fines.
Understanding Bumble For Friends’ ‘Legitimate Interest’
Lisa Steinfeld, a Data Protection lawyer at NOYB, explained the advocacy group’s stance in more detail on its website:
“The fact that Bumble presents its users with option [sic] to say ‘Okay’ to AI Icebreakers is misleading. It creates a false sense of control over your own data. In reality, Bumble claims to have a so-called legitimate interest to use your data without any consent.”
When it comes to Bumble For Friends verifying a user’s identity to prevent fraud, the company sees the user’s personal data — whether given to Bumble with consent or not — as its “legitimate interest.”
However, Bumble also claims that it has a “legitimate interest” in a user’s personal data when it comes to promoting its events and products, as well as targeting advertisements — a controversial claim, says the NOYB.
“When you download the App and create an account, we may collect certain information about you,” reads Bumble for Friends’ Privacy Policy. Included in this information is the user’s gender identity, sexuality, and location, as well as personal photographs the user has shared with the app.
Also in its Privacy Policy, Bumble For Friends addresses one of NOYB’s biggest concerns: whether the dating company has a lawful basis for using user data in EU countries.
As Bumble spells out, it’s possible for EU users to opt out of some data uses, but not all of them.
“Where the legal basis is consent, you can withdraw consent at any time. Where the legal basis is legitimate interests, you have a right to object to our use of your data,” according to the site.
The right to object — but not necessarily to regain privacy over your own data.
The GDPR’s Flexible Definition of Privacy
The phrase “legitimate interests” has sparked the most controversy with NOYB.
Bumble’s claim that it has a “legitimate interest” in user data — and therefore can obtain it from the user’s account without the user’s direct consent — violates Article 5(1)(a) of the GDPR, according to NOYB.
NOYB says Bumble “has violated its transparency obligations under Article 5(1)(a) of the GDPR by failing to provide information about the processing in relation to the Icebreaker feature and by confusing users with a ‘fake’ consent banner.”
Bumble For Friends may ask users to give consent via a consent banner, but this banner is just for show, NOYB alleges.
Bumble’s warnings to users in its privacy policy hasn’t stopped NOYB from lodging an official complaint with the Austrian data protection authority.
Much of the controversy depends on how people interpret the GDPR. The law acknowledges the flexibility of the phrase “legitimate interest”; it can have different applications depending on a company’s situation.
Still, the NOYB’s stance is clear: “Bumble’s claim to have a legitimate interest in sending user data to OpenAI is absurd,” Steinfeld said. “The dating app seems to be so desperate to get in on the AI hype that it is trampling on users’ fundamental rights in the process.”
Bumble For Friends users who don’t want AI Icebreakers to use their personal data must send an official request to BFF support. But there’s no guarantee that Bumble For Friends won’t obtain user data regardless of the request.
And since Bumble hasn’t publicly responded to NOYB’s complaint, it’s unclear whether the company will clarify its stance.
